Fines & penalties under the Cyber Security and Resilience Bill
The CSRB introduces a two-tier penalty regime aligned with the severity of the contravention. The maximum fine is the greater of £17 million or 4% of worldwide turnover — with daily penalties of up to £100,000 for national security direction breaches.
£17M
or 4% of turnover
whichever is greater
The higher maximum penalty
This cap applies to serious contraventions of security duties (Clause 1–4) and incident reporting obligations (Clause 5–7). For a multinational with £1 billion in annual revenue, 4% of turnover equals £40 million — far exceeding the £17M floor.
CSRB penalty tiers explained
The Bill establishes two bands of maximum penalty, calibrated to the severity of the contravention.
| Penalty tier | Maximum fine | Applies to |
|---|---|---|
| Higher maximum | Greater of £17M or 4% of worldwide turnover | Failure to comply with security duties, failure to report significant incidents, failure to comply with enforcement notices |
| Standard maximum | Greater of £10M or 2% of worldwide turnover | Failure to register as a relevant digital service provider or MSP, failure to provide information to regulators, administrative and procedural breaches |
| Part 4: national security directions | £17M or 10% of turnover (undertakings) + up to £100K/day continuing | Failure to comply with a direction issued by the Secretary of State on national security grounds (Clause 49). Daily penalty accrues until compliance is achieved. |
Turnover calculation
The precise definition of "qualifying worldwide turnover" will be set out in secondary legislation after Royal Assent. It is expected to follow the UK GDPR precedent of using the total annual worldwide turnover of the preceding financial year for the undertaking concerned.What could expose you to a penalty
Understanding which obligations carry which tier of penalty is the first step in managing your risk.
Inadequate security measures
Failing to implement appropriate and proportionate technical and organisational measures to manage risks to the security of your network and information systems. Higher maximum applies.
Late or missing incident reports
Failing to notify the relevant authority within 24 hours of becoming aware of a significant incident, or failing to submit a full report within 72 hours. Higher maximum applies.
Registration failures
Failing to register with the relevant regulator as a digital service provider or managed service provider when you meet the in-scope criteria. Standard maximum applies.
Non-compliance with enforcement notices
Ignoring or failing to act on an enforcement notice issued by your regulator. This escalates the original contravention to the higher maximum penalty band.
National security direction breach
Failing to comply with a direction from the Secretary of State under Part 4. Carries a penalty cap of £17M or 10% of turnover, plus £100,000 per day the breach continues.
Obstructing an investigation
Failing to provide information requested by a regulator, failing to permit inspections, or providing false or misleading information. Standard maximum applies.
The enforcement escalation process
Regulators follow a structured process. Understanding it gives you intervention points to resolve issues before penalties are imposed.
Information notice
The regulator requests information about your security measures, incident history, or compliance status. You must respond within the specified timeframe. Failure to respond can itself trigger a penalty.
Assessment and investigation
The regulator assesses your response and may conduct inspections of your systems and processes. Under the cost recovery mechanism, you may be charged for the cost of this investigation regardless of the outcome.
Enforcement notice
If the regulator identifies a contravention, it issues an enforcement notice specifying the breach, the remedial action required, and the deadline. Non-compliance with the enforcement notice can itself attract the higher maximum penalty.
Penalty notice
Where the contravention is not remedied, or is sufficiently serious, the regulator issues a penalty notice setting out the financial penalty. The amount must be proportionate to the contravention, considering severity, duration, cooperation, and any previous contraventions.
Appeal to the First-tier Tribunal
You can appeal the penalty to the First-tier Tribunal (General Regulatory Chamber). The Tribunal can confirm, vary, or set aside the penalty. Schedule 1 of the Bill sets out the appeal procedures.
CSRB vs GDPR vs NIS2 vs DORA
How the CSRB penalty regime compares to other major regulatory frameworks.
| CSRB (UK) | UK GDPR | EU NIS2 | EU DORA | |
|---|---|---|---|---|
| Maximum penalty | £17M / 4% turnover | £17.5M / 4% turnover | Essential: €10M / 2% Important: €7M / 1.4% | €10M / 2% turnover |
| Scope | NIS-regulated entities, MSPs, data centres, critical suppliers | Any organisation processing personal data of UK residents | 18 sectors across EU member states | Financial entities and their ICT service providers (EU) |
| Regulator(s) | ICO, Ofcom, sector-specific regulators | ICO | EU member state competent authorities | European Supervisory Authorities (EBA, EIOPA, ESMA) |
| Daily penalties | Up to £100K/day (Part 4) | No daily penalty provision | Varies by member state | Up to 1% of avg daily turnover/day (ICT providers) |
| Cost recovery | Yes — investigation costs recoverable | No specific cost recovery provision | Varies by member state | No specific provision |
| Dual liability | Separate from GDPR — both may apply to same incident | Separate from CSRB | Coordination to avoid double punishment (Art. 35) | DORA and GDPR penalties can be applied separately |
Dual-regime risk
A single cyber incident could trigger enforcement under both CSRB and UK GDPR simultaneously. A ransomware attack on a regulated entity that compromises personal data could result in penalties from both the sector regulator (for security failures) and the ICO (for data protection failures). Combined exposure could reach £34.5 million or 8% of turnover.Cost recovery: you also pay for the investigation
The CSRB introduces a cost recovery mechanism that allows regulators to charge regulated entities for the costs of their supervisory activities. This includes the costs of investigations, audits, and inspections.
This means that even if no penalty is ultimately imposed, you may still be liable for the costs the regulator incurred during the investigation. The financial exposure from a compliance failure is therefore the penalty plus the investigation costs.
Regulators can also recover costs through periodic fees charged to all regulated entities to fund ongoing oversight — a new operational cost for in-scope organisations.
Director and senior officer liability
Current status and what may change as the Bill progresses through Parliament.
No personal liability — yet
The CSRB as introduced does not impose personal civil penalties on individual directors or officers. Penalties are directed at the regulated entity (the organisation).
However, during the House of Lords committee stage, Peers tabled amendments to introduce personal liability where a compliance failure involves a senior officer's consent, connivance, or deliberate neglect. The government has resisted these amendments, stating that £17M corporate fines and forthcoming board-level governance rules provide sufficient accountability.
Watch this space
The Bill is still progressing through Parliament. Personal liability provisions could be added at a later stage. Regardless, the Cyber Assessment Framework (CAF) already requires board-level oversight of cybersecurity, and directors who fail to exercise reasonable care may face common-law negligence claims from shareholders or insurers.How to reduce your penalty exposure
Regulators must consider mitigating factors when calculating penalties. Proactive compliance significantly reduces your risk.
Implement the CAF
Adopting the NCSC Cyber Assessment Framework demonstrates that you have taken "appropriate and proportionate" measures. This is the primary benchmark regulators will use to assess your security posture.
Build incident reporting capability
Establish processes to detect, triage, and report incidents within the 24-hour initial notification and 72-hour full report deadlines. Tested, rehearsed processes reduce the risk of late-reporting penalties.
Register proactively
If you are a digital service provider or managed service provider meeting the threshold criteria, register with your regulator before enforcement action is taken. Proactive registration is noted as a mitigating factor.
Cooperate with regulators
Full, timely cooperation with information requests and investigations is explicitly listed as a mitigating factor in penalty calculations. Obstruction escalates your exposure.
Document your security posture
Maintain clear evidence of risk assessments, security controls, board-level governance, and supply chain due diligence. Written records demonstrate that your approach was reasonable and proportionate.
Budget for compliance costs
Factor in the cost recovery mechanism. Regulatory fees and investigation costs are now operational expenses. Investing in compliance is cheaper than funding the investigation into your non-compliance.
Frequently asked questions about CSRB penalties
What is the maximum fine a business can face under the new UK CSRB 2026?
The maximum penalty under the Cyber Security and Resilience Bill is the greater of £17 million or 4% of worldwide annual turnover. This "higher maximum" applies to serious contraventions such as failing to meet security duties or failing to report significant incidents. A "standard maximum" of £10 million or 2% of turnover applies to less serious failures such as registration obligations.
Can directors be held personally liable under the CSRB?
The CSRB as introduced does not impose personal civil penalties on directors. However, Peers in the House of Lords have tabled amendments to introduce personal liability where a failure involves a director's consent, connivance, or neglect. The government has resisted these amendments so far, stating that the £17M corporate fines and forthcoming board-level governance requirements provide sufficient accountability. This position may change as the Bill progresses.
How are CSRB penalties calculated?
Regulators must consider several factors: the severity and duration of the contravention, whether the entity took reasonable steps to comply, whether it cooperated with the investigation, any previous contraventions, and the financial benefit gained from non-compliance. The actual penalty amount must be appropriate and proportionate to the contravention.
What is the difference between the higher and standard maximum penalties?
The higher maximum (£17M / 4% turnover) applies to serious contraventions of security duties and incident reporting obligations. The standard maximum (£10M / 2% turnover) applies to failures related to registration, information provision, and administrative requirements. Both apply as "whichever is greater" - so large enterprises will typically be measured by their turnover percentage.
How do CSRB fines compare to GDPR fines?
CSRB and UK GDPR have comparable maximum penalties. UK GDPR allows fines up to £17.5 million or 4% of annual worldwide turnover. The CSRB higher maximum is £17 million or 4% of turnover. However, they cover different obligations - GDPR covers data protection while CSRB covers network and information systems security. An organisation could face penalties under both regimes for the same incident if it involved both a data breach and a security failure.
What are the daily penalties under the CSRB?
Daily continuing-contravention penalties apply specifically to Part 4 national security directions. Non-compliance with a direction carries a daily penalty of up to £100,000. Non-compliance with related information or inspection requirements carries a daily penalty of up to £50,000. These accrue each day the contravention continues until the entity complies.
The cheapest penalty is the one you never face
Proactive compliance reduces your financial exposure by orders of magnitude. Our gap analysis identifies exactly where your risk lies — before the regulator does.